⚡ Quick Summary
Published by Google, this Frontier Safety Framework (Version 3.1, April 17, 2026) sets out protocols intended to address severe risks arising from the high-impact capabilities of frontier AI models, complementing Google's wider AI responsibility and safety practices and informed by the broader conversation on frontier AI safety and security frameworks.
The Framework is built around capability thresholds. Critical Capability Levels (CCLs) mark capability levels at which, absent mitigation, a model may pose heightened risk of severe harm; Tracked Capability Levels (TCLs) capture lower-threshold risks of significant but not severe harm. Thresholds are defined for misuse (CBRN, cyber, harmful manipulation) and for ML R&D and misalignment risks. A five-part risk management process runs from risk identification and inherent risk assessment through mitigation, residual risk assessment and risk acceptance determination, drawing on critical capability assessments, material capability change assessments, early warning evaluations and alert thresholds.
Mitigations are divided into security mitigations, calibrated through security levels aligned to the RAND model weight security framework, and deployment mitigations. The document recommends Security Level 2+ for the misuse CCLs, Security level 3 for ML R&D acceleration level 1 and Security level 4 for ML R&D automation level 1, and sets out governance, annual review and disclosure commitments.
🧩 What’s Covered
The document runs to five sections plus a glossary.
- Section 1: Framework: defines the scope, the CCL and TCL concepts and the risk management process — risk identification, inherent risk assessment, risk mitigation, residual risk assessment and risk acceptance determination — including critical capability assessments before first external deployment, material capability change assessments, early warning evaluations and alert thresholds.
- Section 2: Misuse: the mitigation approach for misuse risks, covering security mitigations built on Google's Secure AI Framework (SAIF) and a defined "Security Level 2+" with measures such as dedicated insider risk teams and sandboxed processing of untrusted inputs, a three-step deployment mitigation process, and the misuse capability levels: CBRN uplift level 1, cyber uplift level 1, harmful manipulation level 1 (exploratory) and the CBRN TCL, each with a recommended security level and rationale.
- Section 3: ML R&D and Misalignment: security and deployment mitigations with an added focus on high-risk internal deployments, the Stealth and Situational Awareness TCL, and two CCLs — ML R&D acceleration level 1, recommended Security level 3, and ML R&D automation level 1, recommended Security level 4.
- Section 4: Governance and Accountability: states that a comprehensive internal governance structure exists, with responsibilities allocated across the organisation, legal, compliance and safety reviews and escalation procedures.
- Section 5: Updates and Disclosures: annual review of the Framework, the assessment steps involved, disclosure of model information, evaluation results and mitigation plans to government authorities where a CCL poses unmitigated and material risk, and a version history (3.1, 3.0, 2.0, 1.0).
- Glossary: defines model, risk domains, thresholds, inherent risk assessment, risk mitigation terms such as response plans and deployment and security mitigations, residual risk assessments and safety cases.
💡 Why it matters?
The Framework is an example of a developer-side safety commitment that translates abstract capability risk into operational checkpoints. It helps safety, security and compliance functions see how capability evaluations, alert thresholds, safety cases and security levels are meant to connect before and after deployment, and where proportionality is used to balance safety with innovation. The document ties its security levels to the RAND model weight security framework and points to other frontier safety frameworks, including governmental emerging-process work and other labs' preparedness and responsible scaling policies, which makes it useful for comparing approaches.
❓ What’s Missing
Practical detail is limited in places. Governance is described only in general terms, with no named bodies, roles, decision rights or escalation routes. The CCLs and TCLs are qualitative definitions without concrete evaluation thresholds or scoring. Harmful manipulation work is explicitly labelled exploratory and expected to change. No authors are named. The Framework notes that it is based on early and evolving research, will be reviewed at least annually and may evolve substantially, so it is a point-in-time statement of approach rather than a settled standard, and it commits to no independent external audit or verification.
👥 Best For
AI governance and policy teams at model developers, safety and security leads designing capability evaluation and mitigation processes, and risk or compliance staff who need to understand how a frontier lab structures capability thresholds, security levels and pre-deployment review. It also suits regulators, auditors and researchers comparing frontier safety frameworks across labs.
📄 Source Details
The document is Frontier Safety Framework, Version 3.1, published April 17, 2026, 20 pages, in English; no authors are named and no publisher statement appears on the cover, though the text refers to Google throughout. It lists earlier versions: Version 3.0 (September 22, 2025), Version 2.0 (February 4, 2025) and Version 1.0 (May 17, 2024). No URL for the document itself is printed; footnotes cite external sources such as the RAND model weight security framework. The full 20-page text extraction was available.
